CVE-2026-115915

The vLLM inference and serving engine (prior to version 0.32.0 ) is vulnerable to a security flaw where the ImageMediaIO component passes attacker-controlled image bytes to Pillow via Image.open(BytesIO(data)). Because the application fails to restrict decoder selection and the MIME label does no...

CVE-2026-115915 vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.openBytesIOdata without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request...